LiveActive security incident?Get immediate response
CVE Record

CVE-2024-36932: thermal/debugfs: Prevent use-after-free from occurring after cdev removal

In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Prevent use-after-free from occurring after cdev removal Since thermal_debug_cdev_remove() does not run under cdev->lock, it can run in parallel with thermal_debug_cdev_state_update() and it may free the struct thermal_debugfs object used by the latter after it has been checked against NULL. If that happens, thermal_debug_cdev_state_update() will access memory that has been freed already causing the kernel to crash. Address this by using cdev->lock in thermal_debug_cdev_remove() around the cdev->debugfs value check (in case the same cdev is removed at the same time in two different threads) and its reset to NULL. Cc :6.8+ <stable@vger.kernel.org> # 6.8+

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel issue can crash a system when thermal cooling-device debug cleanup races with a state update. The business impact is availability, not confirmed data theft or privilege escalation. Evidence in the provided sources does not show active exploitation, public weaponization, or a CVSS score.

Executive priority

Treat this as a routine-to-important availability fix for affected Linux fleets. Escalate priority for production hosts, embedded systems, or appliances where a kernel crash creates business disruption. Current evidence does not support emergency treatment based on active exploitation.

Technical view

CVE-2024-36932 is a use-after-free in Linux thermal/debugfs. thermal_debug_cdev_remove() could free a thermal_debugfs object while thermal_debug_cdev_state_update() still uses it because removal was not protected by cdev->lock. The kernel fix locks the removal path around the debugfs pointer check and reset.

Likely exposure

Exposure appears limited to Linux systems using affected 6.8+ kernel thermal/debugfs code before the referenced stable fixes. Systems not running affected Linux kernel versions or not exposing this code path are less likely to be impacted, but the source bundle does not define operational prerequisites fully.

Exploitation context

The provided sources describe a race condition causing a kernel crash. CISA KEV status is false, and no cited source reports active exploitation. The bundle does not provide exploitability details, attacker prerequisites, or whether local access is required.

Researcher notes

The key condition is concurrent cooling-device removal and state update around cdev->debugfs. The fix uses cdev->lock to serialize pointer validation and NULL reset. Source evidence is concise and does not include CVSS, exploit primitives, or distribution-specific package mappings.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced fixes.
  • Prioritize affected Linux 6.8+ systems where availability matters.
  • Check distribution vendor advisories for backported fixed kernel packages.
  • Avoid unsupported kernels where stable fixes are unavailable.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and endpoints.
  • Compare running kernels with vendor advisories and referenced stable commits.
  • Confirm patched systems include the thermal/debugfs locking fix.
  • Review crash logs for thermal/debugfs-related kernel faults.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-36932 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: total

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux755113d7678681a137c330f7997ceb680adb644e, 755113d7678681a137c330f7997ceb680adb644eunaffected
LinuxLinux6.8, 0, 6.8.10, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.